MCSB NS-1: Network Security
25 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control NS-1 (Network Security). Each is checked against your tenant, ranked by Severity, with validated remediation.
What MCSB NS-1 covers
The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. NS-1 sits in the Network Security domain. Senserva evidences it with the 25 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.
Ask your own AI about this control
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
The 25 checks that evidence MCSB NS-1
Click any row for why it matters and how to fix it, with a link to the full check page.
| Senserva check | Severity | What it verifies |
|---|---|---|
| Internet Facing VM Protected By Nsg | High | Internet-facing VM is protected by a Network Security Group (NSG) |
| Intune Policy Firewall Domain Network Default Inbound Action | High | Windows Firewall default inbound action for Domain network is not set to Block |
| Intune Policy Firewall Domain Network Enablement | High | Windows Firewall is not enabled for Domain network profile |
| Intune Policy Firewall Private Network Default Inbound Action | High | Windows Firewall default inbound action for Private network is not set to Block |
| Intune Policy Firewall Private Network Enablement | High | Windows Firewall is not enabled for Private network profile |
| Intune Policy Firewall Public Network Default Inbound Action | High | Windows Firewall default inbound action for Public network is not set to Block |
| Intune Policy Firewall Public Network Disabled Inbound Action Notifications | High | Windows Firewall inbound action notifications not disabled for Public network |
| Intune Policy Firewall Public Network Enablement | High | Windows Firewall is not enabled for Public network profile |
| Intune Policy Firewall Public Network IP Sec Merge | High | IPsec exemptions are allowed on Public network profile |
| Intune Policy Firewall Public Network Local Policy Merge | High | Local firewall policy merge is enabled on Public network profile |
| Intune Policy Firewall Public Network Log Dropped Packets | High | Windows Firewall is not configured to log dropped packets on Public network |
| Intune Policy Firewall Domain Network Disabled Inbound Action Notifications | Medium | Windows Firewall inbound action notifications are not disabled for Domain network |
| Intune Policy Firewall Domain Network Log Dropped Packets | Medium | Windows Firewall is not configured to log dropped packets on Domain network |
| Intune Policy Firewall Private Network Log Dropped Packets | Medium | Windows Firewall is not configured to log dropped packets on Private network |
| Intune Policy Firewall Property Not Found | Medium | Expected firewall property was not found in the Intune policy configuration |
| Network Flow Logs Configured | Medium | TODO: Network flow logs configuration check. Not yet implemented |
| Non Internet Facing VM Protected By Nsg | Medium | Non-internet-facing VM is protected by a Network Security Group (NSG) |
| Nsg Flow Logs Enabled | Medium | NSG flow logs are enabled for network traffic monitoring and forensics |
| Intune Policy Firewall Private Network Disabled Inbound Action Notifications | Low | Windows Firewall inbound action notifications are not disabled for Private network |
| Intune Policy Firewall Domain Network Log Max File Size | Info | Windows Firewall log file size for Domain network is below recommended threshold |
| Intune Policy Firewall Domain Network Log Successful Connections | Info | Windows Firewall is not configured to log successful connections on Domain network |
| Intune Policy Firewall Private Network Log Max File Size | Info | Windows Firewall log file size for Private network is below recommended threshold |
| Intune Policy Firewall Private Network Log Successful Connections | Info | Windows Firewall is not configured to log successful connections on Private network |
| Intune Policy Firewall Public Network Log Max File Size | Info | Windows Firewall log file size for Public network is below recommended threshold |
| Intune Policy Firewall Public Network Log Successful Connections | Info | Windows Firewall is not configured to log successful connections on Public network |
Also evidences
The same checks provide evidence for these frameworks, so one fix counts across your obligations:
Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.